Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
7e19b2b97cc2e5de685917189f391499.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7e19b2b97cc2e5de685917189f391499.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$_3_.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$_3_.exe
Resource
win10v2004-20231222-en
General
-
Target
$_3_.exe
-
Size
1.7MB
-
MD5
d4c16982f8a834bc0f8028b45c3ae543
-
SHA1
9d9cec9af8f23a23521e20d48d9af1024663a4a7
-
SHA256
932badf8ce27381bd595c9d861d7f7142fe98f233a893a2003a5f5e5ec163b3b
-
SHA512
c94b8d978afac107c08a5405cf9510e48d4bcf1284292eee1d08898f1c7a43a83a9655dc4d85d27d3b825e45a8f136c7beb71405fab94bb5e2437b7c4ad44b5c
-
SSDEEP
49152:n7mrmYPoEHVGTWFkO4ITVpSuEqM/vrM3rA3SuN5:km2Z12WFYFVf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation $_3_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3256 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3572 $_3_.exe 3572 $_3_.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3572 $_3_.exe 3572 $_3_.exe 3572 $_3_.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3572 wrote to memory of 4112 3572 $_3_.exe 94 PID 3572 wrote to memory of 4112 3572 $_3_.exe 94 PID 3572 wrote to memory of 4112 3572 $_3_.exe 94 PID 4112 wrote to memory of 3256 4112 cmd.exe 96 PID 4112 wrote to memory of 3256 4112 cmd.exe 96 PID 4112 wrote to memory of 3256 4112 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_3_.exe"C:\Users\Admin\AppData\Local\Temp\$_3_.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\21753.bat" "C:\Users\Admin\AppData\Local\Temp\13CEE210B0034F41B796946A9F7796B8\""2⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:3256
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD50b501af25fb6d08a4a3f58168b089ecc
SHA19c3bc2a76aca27f2ae7b462054b8c9be57476947
SHA256ab2f51f77f1c38b134f5fc386c139afdac5cafb05d6d2238147c48d18c569365
SHA5121b956878cff3a7997ddbb35e24d2b936cb5f469bd2662c9ff664e60bd12c001677648c8bbb55280ac031b081c3540c6910d1a89ee3d862483d20ef8989830f11
-
Filesize
98B
MD5cda4aa733f0292aa9cb8addcb9ca27b2
SHA1bc8aee8b67b644cf78d768da9dcf2dd3cc007d0f
SHA256b7c18bafe48139f027c6b2361e073412709e8d3e4c3400c740290e0b67144255
SHA512e9a347eb3cb94356318f3666c0c6a7e3d9b05799e43c3b3a8a6abd0bb87a0eb683555e2208e032675bc8915349dff7f76b7dd8e29d8cb9e03dee4fba035dfb2d
-
C:\Users\Admin\AppData\Local\Temp\13CEE210B0034F41B796946A9F7796B8\13CEE210B0034F41B796946A9F7796B8_LogFile.txt
Filesize2KB
MD5f62697e4ae0baed612ddd0bc2a925c31
SHA159c5f83211e8bc701704a0e950b8700c089d16bd
SHA256d1f3906eb50e139e25ac3d8c49ef83ca91dd5fda2246989ca0d3987702db32a7
SHA512e121e27c6803e6a3a756e14034110b6b70f04c002013b87010f5ecbbf54fa5e87230b692293a16492861a551c4d473d5a9c10ad1c8cdce8c41b06b50e1c0ea7c
-
C:\Users\Admin\AppData\Local\Temp\13CEE210B0034F41B796946A9F7796B8\13CEE210B0034F41B796946A9F7796B8_LogFile.txt
Filesize4KB
MD579c292cc60463f0bf3a485d84ef95efc
SHA17365719d6620989d1a2002cf11dd01d5dbad6871
SHA2566efa5b99e0fb3922db2f68c93efda9dde4b73ac676709ea84006c482ce6ada6f
SHA512585dfd8628a2ebd602df269f44e8236135af8c13d394d70ecd9efa71092470c6507af7eac8d169dfe074c4213310d540566e211c19d597abab917a5f5a5ecedf
-
C:\Users\Admin\AppData\Local\Temp\13CEE210B0034F41B796946A9F7796B8\13CEE210B0034F41B796946A9F7796B8_LogFile.txt
Filesize4KB
MD5c256229ea9bf855a78d218ad1b37293e
SHA15eb7a4134f2d46d9ff48e7cb68562e5e1b0eeaab
SHA256e0c967022faa7d0d97aad3130cab7e0b00b5164ab62ce4f470f7705f30ac571c
SHA512363cdf0306f3cc4c49562eabf4af9c8a65fec478f2d16df2ae4d8104f188ef0ac7b2e8f9f1f97d69b2e3bd3874c53085d7b8a0cb5742a657fd89ee27ef6ac0b3
-
Filesize
26KB
MD561c15dd74e1d20f4ee51274e09bcfb48
SHA163377acc24571bbc4fee480a6fd7fbcb8336d1eb
SHA2563191587086e7d6d91b8b67f78deabe92f0ba5527ef8d9a3a4167c40fa3fbe4d6
SHA512f6f2920a6c2dbbc616b74a55f7476ca6a94348468810847c8b07eb4a60aaf3e61303e0681b3aef1a8c803124f77504cfb1764cdb8cb6e75c041e6ffef176f741
-
Filesize
212B
MD5668767f1e0c7ff2b3960447e259e9f00
SHA132d8abf834cce72f5e845175a0af2513b00504d8
SHA256cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
SHA512c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680